<html><body><div dir=""><div dir="ltr">
<br><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 19Mar, 2021 at 10:27:17, Nate Klingenstein <<a href="mailto:ndk@signet.id">ndk@signet.id</a>> wrote:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><br>There should be no reason why you would need to base your persistentId generation on a particular attribute for a particular vendor. <br>
</div>
</div>
</blockquote><br>
</div><div class="gmail_quote" dir="ltr">Love the perspective, but multiple SPs make that demand of my IdP, so I have a string of such clauses, basing NameID on email, ePPN, uid, employee #, etc.</div><div class="gmail_quote" dir="ltr">Sometimes they also specify a format for the NameID, even one that is inconsistent with the normal form of the identifier they want! In a world where 1:1 trust and configuration is the norm, SP vendors don’t see a reason not to make up anything that occurs to them and make it a “requirement" for “federation” with their app.</div><div class="gmail_quote" dir="ltr"><br></div><div class="gmail_quote" dir="ltr">Evangelize multi-lateral federation!</div><div class="gmail_quote" dir="ltr"><br></div><div class="gmail_quote" dir="ltr">David St. Pierre Bantz</div><div class="gmail_quote" dir="ltr">U Alaska</div>
</div></div></body></html>